CVE-2022-3850 Find and Replace All <= 1.3 - Arbitrary Replacement via CSRF

2022-11-2813:47:12

WPScan

www.cve.org

wordpress

plugin

csrf

vulnerability

database tables

5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.3%

JSON

The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Find and Replace All",
    "collectionURL": "https://wordpress.org/plugins",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.3"
      }
    ],
    "defaultStatus": "unaffected"
  }
]